Bug 1622986

Summary:	Lockdown kernel patch completely disables BPF syscall
Product:	[Fedora] Fedora	Reporter:	Timothée Ravier <tim>
Component:	kernel	Assignee:	Kernel Maintainer List <kernel-maint>
Status:	CLOSED INSUFFICIENT_DATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	29	CC:	airlied, bskeggs, ewk, hdegoede, ichavero, itamar, jarodwilson, jforbes, jglisse, john.j5live, jonathan, josef, jsitnicki, kernel-maint, linville, mchehab, mjg59, pbrobinson, steved
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-02-21 21:06:23 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1269538

Description Timothée Ravier 2018-08-28 10:32:13 UTC

Description of problem:

Booting Fedora with Secure Boot enabled will result in Lockdown being enabled at boot time. This will completly disable the BPF system call for all users [1][2].

Unfortunately, this breaks the IPAddressAllow & IPAddressDeny systemd feature
[3][4][5].

I don't have a solution for this, but as far as I understand, this will also prevent other BPF use-cases (for example: Cilium on Fedora CoreOS).

[1] https://src.fedoraproject.org/rpms/kernel/blob/master/f/efi-lockdown.patch#_1525
[2]
https://git.kernel.org/pub/scm/linux/kernel/git/jforbes/linux.git/commit/?h=lockdown&id=0eb0d0851747787f7182b3e9d0d38edb5925a678
[3] https://github.com/systemd/systemd/blob/master/src/core/bpf-firewall.c
[4] https://github.com/systemd/systemd/blob/master/NEWS#L1192
[5]
https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html#IPAddressAllow=ADDRESS[/PREFIXLENGTH]%E2%80%A6

How reproducible:

Always

Steps to Reproduce:
1. Boot Fedora with lockdown enabled (for example: use Secure Boot)

Actual results:

systemd complains that it can not use the IPAddressAllow & IPAddressDeny features.

Expected results:

IPAddressAllow & IPAddressDeny features are available.

Comment 1 Timothée Ravier 2018-08-28 10:33:56 UTC

From: https://lists.fedoraproject.org/archives/list/kernel@lists.fedoraproject.org/thread/TDNMHIVEAKJHCYD4ZTDLRA6LW42CATGQ/

Comment 2 Justin M. Forbes 2018-08-28 20:38:23 UTC

This is a problematic one, but I don't know the real solution just yet. As it stands, I will drop the BPF restriction for the 4.18 rebases, but leave this bug open while I come up with something better.

Comment 3 Justin M. Forbes 2019-01-29 16:13:59 UTC

*********** MASS BUG UPDATE **************

We apologize for the inconvenience.  There are a large number of bugs to go through and several of them have gone stale.  Due to this, we are doing a mass bug update across all of the Fedora 29 kernel bugs.

Fedora 29 has now been rebased to 4.20.5-200.fc29.  Please test this kernel update (or newer) and let us know if you issue has been resolved or if it is still present with the newer kernel.

If you experience different issues, please open a new bug report for those.

Comment 4 Justin M. Forbes 2019-02-21 21:06:23 UTC

*********** MASS BUG UPDATE **************
This bug is being closed with INSUFFICIENT_DATA as there has not been a response in 3 weeks. If you are still experiencing this issue, please reopen and attach the relevant data from the latest kernel you are running and any data that might have been requested previously.